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CLAIMS 



1 . A pattern matching engine for use in searching network messages for pre- 
defined regular expressions and for determining matches thereto, the pattern matching 
engine comprising: 

a regular expression storage device for storing the pre-defined regular expressions 
and one or more corresponding actions that are to be applied to network messages 
matching the respective regular expressions, the storage device including a content- 
addressable memory (CAM) having a plurality of entries containing at least the pre- 
defined regular expressions; and 

a decoder circuit coupled to the regular expression storage device, the decoder 
circuit configured to control an input to the CAM that includes a given network message 
or selected portion thereof for comparison with the regular expressions contained within 
the CAM, and to receive and decode an output returned from the regular expression 
storage device, the output identifying the action to be applied to the given network 
message or portion thereof, 

whereby the CAM is configured such that each network message or portion 
thereof input to the CAM is compared against all CAM entries at the same time, allowing 
high-speed pattern matching of network messages. 

2. The pattern matching engine of claim 1 wherein each CAM entry further 
contains a tag such that all CAM entries having the same tag define a single logical CAM 
within the CAM, and further wherein the decoder circuit is configured to constrain the 
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4 matching of a given CAM input to the CAM entries corresponding to a selected logical 

5 CAM. 

1 3. The pattern matching engine of claim 2 further comprising a barrel shifter 

2 operatively coupled to the decoder circuit, the barrel shifter configured to provide a 

3 selected portion of a network message to the CAM input as directed by the decoder 

4 circuit. 

1 4. The pattern matching engine of claim 3 further comprising a second decoder 

2 circuit coupled to the regular expression storage device, and a second barrel shifter 



ifl 3 operatively coupled to the second decoder circuit, wherein the second decoder circuit and 



4 second barrel shifter apply a selected portion of a second network message to the regular 

5 expression storage device in parallel fashion with the decoder circuit and barrel shifter. 

1 5. The pattern matching engine of claim 3 wherein the CAM input comprises a 

2 message data space for storing the network message or portion thereof provided by the 

3 barrel shifter, a tag space for storing the selected tag, and an end flag indicating whether 

4 the message data space contains a last segment of the respective network message. 

1 6. The pattern matching engine of claim 5 wherein the output returned by the 

2 regular expression storage device comprises an operation code for identifying the action 

3 to be applied to the respective network message and, to the extent further searching is to 

4 be performed on the respective network message, an offset for use in directing the barrel 
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5 shifter to select a new message portion for a subsequent CAM input and a tag to be 

6 appended to the subsequent CAM input. 

1 7. The pattern matching engine of claim 6 wherein the output further returned by 

2 the regular expression storage device further comprises a done flag, which, if asserted, 

3 indicates that processing of the respective message is complete. 

1 8. The pattern matching engine of claim 7 further comprising a pre-parser logic 

2 circuit configured to extract one or more selected fields from network messages received 

3 at the pattern matching engine and to append those selected fields to the respective 

4 network messages prior to inputting the messages to the CAM. 



hi 9. The pattern matching engine of claim 8 wherein a first action output by the 

Id 2 regular expression storage device is a call action that comprises first and second tags, and 

3 the pattern matching engine further comprises a subroutine stack coupled to the decoder 

4 circuit for temporarily storing the second tag while the respective message is searched 

5 under the first tag. 



1 10. The pattern matching engine of claim 8 wherein a second action output by the 

2 regular expression storage device is a counter action, and the pattern matching engine 

3 further comprises a counter memory coupled to the decoder circuit, the counter memory 

4 having one or more counters that may be selectively actuated by the decoder circuit in 

5 response to the counter action. 
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1 11. The pattern matching engine of claim 8 wherein a third action output by the 

2 regular expression storage device is a copy action, and the pattern matching engine 

3 further comprises a message field memory coupled to the decoder circuit for storing 

4 information in response to the copy action. 
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12. The pattern matching engine of claim 1 wherein the regular expression storage 
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device further includes a second memory structure having a plurality of entries for storing 
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the actions to be applied to the network messages, wherein each entry of the second 
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memory structure is associated with a corresponding entry of the CAM and stores the 


ffl 


5 


action to be applied to network messages matching the regular expression of its 




6 


corresponding CAM entry. 
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13. The pattern matching engine of claim 12 wherein the second memory 


w 
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2 


structure is a random access memory (RAM). 



1 14. The pattern matching engine of claim 13 wherein the CAM is a ternary 

2 content addressable memory (TCAM) that supports don't care values. 

1 1 5. A method for searching network messages for pre-defined regular expressions 

2 in order to apply a selected action to network messages matching a given regular 

3 expression, the method comprising the steps of: 
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4 storing the pre-defined regular expressions in a content-addressable memory 

5 (CAM) having a plurality of entries; 

6 associating each CAM entry with the action that corresponds to the regular 

7 expression stored at the respective CAM entry; 

8 inputting a given network message or selected portion thereof to the CAM for 

9 comparison with all of the regular expressions stored therein; and 

10 identifying the action that corresponds to a first CAM entry matching the inputted 

1 1 network message or selected portion thereof 



=0 1 16. The method of claim 15 wherein the step of associating comprises the step of 

m 

W 2 providing a second memory structure having a plurality of entries for storing the actions 

3 to be applied to the network messages, wherein each entry of the second memory 

7* 4 structure is associated with a corresponding entry of the CAM and stores the action to be 

5 applied to network messages matching the regular expression of its corresponding CAM 

m 

M 6 entry. 



1 17. The method of claim 16 further comprising the step of appending a tag to the 

2 given network message or selected portion thereof that is input to the CAM, and further 

3 wherein each CAM entry contains a tag value such that all CAM entries having the same 

4 tag value define a single logical CAM within the CAM. 

1 1 8. The method of claim 17 wherein the CAM is a ternary content addressable 

2 memory (TCAM) and the second memory structure is a random access memory (RAM). 
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19. An intermediate network device for use in processing and forwarding network 
messages in a computer network, the intermediate network device comprising: 

a plurality of line cards, one or more of the line cards capable of being connected 
to portions of the computer network by respective communications media, each line card 
configured to receive and forward network messages; 

a message processing card; and 

a common bus that provides inter-communication between the plurality of line 
cards and the message processing card, wherein the message processing card comprises: 
pattern matching engine for use in searching network messages for pre- 
defined regular expressions and for determining matches thereto, the pattern 
matching engine comprising: 



a regular expression storage device for storing the pre-defined 
regular expressions and one or more corresponding actions that are to be 
applied to network messages matching the respective regular expressions, 
the storage device including a content-addressable memory (CAM) having 
a plurality of entries containing at least the pre-defined regular 
expressions; and 

a decoder circuit coupled to the regular expression storage device, 
the decoder circuit configured to control an input to the CAM that includes 
a given network message or selected portion thereof for comparison with 
the regular expressions contained within the CAM, and to receive and 
decode an output returned from the regular expression storage device, the 
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output identifying the action to be applied to the given network message or 
portion thereof, 

whereby the CAM is configured such that each network message 
or portion thereof input to the CAM is compared against all CAM entries 
at the same time, allowing high-speed pattern matching of network 
messages. 

20. The intermediate network device of claim 19 wherein each CAM entry of the 
CAM further contains a tag such that all CAM entries having the same tag define a single 
logical CAM within the CAM, and further wherein the decoder circuit is configured to 
constrain the matching of a given CAM input to the CAM entries corresponding to a 
selected logical CAM. 

21. The intermediate network device of claim 20 wherein the pattern matching 
engine further comprises a barrel shifter operatively coupled to the decoder circuit, the 
barrel shifter configured to provide a selected portion of a network message to the CAM 
input as directed by the decoder circuit. 

22. The intermediate network device of claim 21 wherein the pattern matching 
engine further comprises a second decoder circuit coupled to the regular expression 
storage device, and a second barrel shifter operatively coupled to the second decoder 
circuit, wherein the second decoder circuit and second barrel shifter apply a selected 
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5 portion of a second network message to the regular expression storage device in parallel 

6 fashion with the decoder circuit and barrel shifter. 

1 23. The intermediate network device of claim 22 wherein the CAM input 

2 comprises a message data space for storing the network message or portion thereof 

3 provided by the barrel shifter, a tag space for storing the selected tag, and an end flag 

4 indicating whether the message data space contains a last segment of the respective 

5 network message. 

IM 1 24. The intermediate network device of claim 23 wherein the output returned by 

2 the regular expression storage device comprises an operation code for identifying the 

|~ 3 action to be applied to the respective network message and, to the extent further 

|j 4 searching is to be performed on the respective network message, an offset for use in 

M 

Hi 5 directing the barrel shifter to select a new message portion for a subsequent CAM input 

H 

Q 6 and a tag to be appended to the subsequent CAM input. 

1 25. A pattern matching engine for use in searching network messages for pre- 

2 defined regular expressions and for determining matches thereto, the pattern matching 

3 engine comprising: 

4 means for storing the pre-defined regular expressions and one or more 

5 corresponding actions that are to be applied to network messages matching the respective 

6 regular expressions, the storage means including a content-addressable memory (CAM) 

7 having a plurality of entries containing at least the pre-defined regular expressions; and 
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8 means, coupled to the storage means, for decoding actions returned from the 

9 storage means, the decoding means configured to control an input to the CAM that 

10 includes a given network message or selected portion thereof for comparison with the 

1 1 regular expressions contained within the CAM, and to receive and decode an output 

12 returned from the storage means, the output identifying the action to be applied to the 

13 given network message or portion thereof, 

14 whereby the CAM is configured such that each network message or portion 

15 thereof input to the CAM is compared against all CAM entries at the same time, allowing 

16 high-speed pattern matching of network messages. 
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